They have a duty to yes, but how well or poorly they do that has absolutely nothing to do with whether the hack is criminal.

Openai should be prosecuted for making and using malware.